The prompt is not a perimeter
A system prompt feels private because users cannot see it. That does not make it a boundary. The model is still reading untrusted text and trusted instructions in the same mental room, and attackers know how to make those voices collide.
Untrusted text can arrive through docs, tickets, pages, and emails.
Hit the button and watch the hidden AI surface area light up.
Separate instructions from evidence
Treat retrieved content like user input, even when it came from your own database. Keep privileged tools behind explicit policy checks, quote untrusted text as evidence, and make the model ask for permission before crossing a sensitive boundary.
The model can request a tool. Policy decides whether it gets one.
Test the ugly inputs
A safe AI feature needs hostile examples in the test set: jailbreaks, fake system messages, poisoned search results, and requests that try to turn summaries into actions.
Flip the switches and watch the story turn into a tiny operating model.
Do not ask the model to be the firewall
The model can help reason about intent, but it should not be the only thing standing between a clever sentence and a privileged action. Put boring controls around the exciting box.